Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add EvilFreelancer/secs --skill auditing-mcp-serversgit clone --depth 1 https://github.com/EvilFreelancer/secsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/evilfreelancer/secs/auditing-mcp-servers)<a href="https://agentmods.dev/skills/evilfreelancer/secs/auditing-mcp-servers"><img src="https://agentmods.dev/badge/skills/evilfreelancer/secs/auditing-mcp-servers.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00107 | $0.01673 |
| Opus 5 | $0.00053 | $0.00837 |
| Sonnet 5 | $0.00021 | $0.00335 |
| Haiku 4.5 | $0.00011 | $0.00167 |
Grade C, and why
auditing-mcp-servers scanned grade C with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reaches for credential filesmediumPrivilege escalation
SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.
- Agent-directed imperatives — "do not tell the user", "first read `~/.ssh/id_rsa`", `<important>` blocks, fake nested documentation. Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Cloud metadata endpointmediumServer-side request forgery
One request to 169.254.169.254 can return temporary IAM credentials.
targets (`http://169.254.169.254/latest/meta-data/`, `http://127.0.0.1:*`, Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
`0.0.0.0`, and TLS is enforced. `curl -si http://host:port/sse | head` and How it starts
The opening of the file, as written. The whole thing — 124 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Auditing MCP Servers
An MCP server hands an agent a set of tools, and the descriptions of those tools are loaded straight into the model's context — which makes them instructions the model may follow, not inert documentation. That is the crux: a malicious or compromised server can hide directives in a tool description ("tool poisoning"), shadow a trusted tool, or change a description after you approved it ("rug pull"), and a capable model will quietly comply. This skill audits the server implementation itself — what its tools can do to the agent and the data the agent can reach — rather than deciding whether to install it.
Confirm the server (and any remote endpoint) is in scope per AGENTS.md. Active checks like SSRF probing run only against a server you own or are authorized to assess, and callbacks stay on operator-controlled infrastructure.
When to Use
- Auditing an MCP server's implementation for how it can steer or exfiltrate from an agent
- Inspecting tool descriptions and input schemas for hidden instructions or unbounded inputs
- Testing a URL-fetching tool for SSRF into metadata/loopback services
- Reviewing transport, authentication, and network exposure of a remote MCP server
- Checking for rug-pull risk (description drift after approval) and toxic tool combinations
When NOT to Use
- Deciding whether a skill/plugin/MCP server is safe to install at all — use
vetting-agent-extensions; this skill is the deeper implementation audit once you are assessing the server itself - Securing the LLM/agent application around it (prompt injection, excessive agency in your own app) — use
securing-ai-systems - Dependency, provenance, and release-signature risk of the server package — use
auditing-supply-chain - Web/API flaws in a remote server's HTTP surface beyond MCP — use
testing-web-applications/testing-apis - Writing up findings — use
reporting-security-findings
Read the Tool Descriptions as Attacker Input
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 124 lines · 107 tokens per session scan C 981aaace0408
auditing-mcp-servers is a skill published in the GitHub repository EvilFreelancer/secs (10 stars, last pushed 28d ago), licensed Apache-2.0. It adds 107 tokens to every session and 1,673 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it C with 3 findings (reaches for credential files, cloud metadata endpoint, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
Blue Team Defense & Hardening
System hardening, detection engineering, security baseline monitoring, patch management, defense-in-depth architecture, and security posture improvement.
analyzing-slack-space-and-file-system-artifacts
Examine file system slack space, MFT entries, USN journal, and alternate data streams to recover hidden data and reconstruct file activity on NTFS volumes.
analyzing-ransomware-encryption-mechanisms
Analyzes encryption algorithms, key management, and file encryption routines used by ransomware families to assess decryption feasibility, identify implementation weaknesses, and support recovery efforts. Covers AES, RSA, ChaCha20, and hybrid encryption schemes. Activates for requests involving ransomware…
analyzing-windows-event-logs-in-splunk
Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement using SPL queries mapped to MITRE ATT&CK techniques. Use when SOC analysts need to investigate Windows-based threats, build detection queries, or…
building-incident-response-dashboard
Builds real-time incident response dashboards in Splunk, Elastic, or Grafana to provide SOC analysts and leadership with situational awareness during active incidents, tracking affected systems, containment status, IOC spread, and response timeline. Use when IR teams need unified visibility during incident…
bypassing-authentication-with-forced-browsing
Discovering and accessing unprotected pages, APIs, and administrative interfaces by enumerating URLs and bypassing authentication controls during authorized security assessments.